cpython

mirror of https://github.com/python/cpython.git synced 2026-01-26 21:03:34 +00:00

History

[3.9] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (GH-131412)

Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from @bitdancer.]

(cherry picked from commit 295b53df2aa18deb625a7da41f7e4babfe6ef34b)

Co-authored-by: Mike Edmunds <medmunds@gmail.com>
Co-authored-by: R David Murray <rdmurray@bitdance.com>

2025-04-03 18:27:33 +02:00

asyncio

[3.9] gh-121957: Emit audit events for python -i and python -m asyncio (GH-122120)

2024-07-22 13:49:47 +02:00

collections

bpo-43102: Set namedtuple __new__'s internal builtins to a dict. (GH-24439) (GH-24452)

2021-02-04 16:12:34 -08:00

concurrent

[3.10] gh-90622: Do not spawn ProcessPool workers on demand via fork method. (GH-91598) (GH-92497) (#92499 )

2022-05-08 11:22:36 -07:00

ctypes

bpo-46913: Fix test_ctypes, test_hashlib, test_faulthandler on UBSan (GH-31675) (GH-31676)

2022-03-04 01:31:54 +01:00

curses

…

dbm

…

distutils

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

[3.9] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (GH-131412)

2025-04-03 18:27:33 +02:00

encodings

[3.9] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222) (#99230 )

2022-11-10 16:57:41 +01:00

ensurepip

[3.9] gh-101997: Update bundled pip version to 23.0.1 (GH-101998). (#102243 )

2023-03-28 10:52:56 +02:00

html

Add source for character mappings (GH-92014) (#92388 )

2022-05-06 12:58:10 +02:00

http

[3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) (#123107 )

2024-09-04 17:49:40 +02:00

idlelib

[3.9] gh-97032: avoid test_squeezer crash on macOS buildbots (GH-115508) (#115655 )

2024-02-21 12:17:44 +01:00

importlib

[3.9] bpo-47004: Sync with importlib_metadata 4.11.3. (GH-31854). (GH-31859)

2022-03-13 17:30:07 -04:00

json

bpo-46001: Change OverflowError to RecursionError in JSON library docstrings (GH-29943)

2021-12-07 02:25:02 -08:00

lib2to3

bpo-46542: test_lib2to3 uses support.infinite_recursion() (GH-31035)

2022-01-31 12:03:44 -08:00

logging

[3.9] bpo-46063: Improve algorithm for computing which rolled-over log file… (GH-30093) (GH-30095)

2021-12-14 01:19:50 +00:00

msilib

[3.9] [codemod] Fix non-matching bracket pairs (GH-28473) (GH-28512)

2021-09-22 17:32:04 +02:00

multiprocessing

[3.9] gh-97514: Don't use Linux abstract sockets for multiprocessing (GH-98501) (#98504 )

2022-10-28 12:08:30 +02:00

pydoc_data

Python 3.9.15

2022-10-11 16:48:37 +02:00

site-packages

…

sqlite3

[3.9] gh-80254: Disallow recursive usage of cursors in sqlite3 converters (#92278 )

2022-05-05 12:47:58 -07:00

test

[3.9] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (GH-131412)

2025-04-03 18:27:33 +02:00

tkinter

[3.9] gh-107262: Update Tkinter tests for Tcl/Tk 8.6.14 (GH-119322) (#130275 )

2025-02-19 10:53:20 +02:00

turtledemo

bpo-44254: On Mac, remove disfunctional colors from turtledemo buttons (GH-26448)

2021-05-29 04:16:34 -04:00

unittest

[3.10] gh-91676 gh-91260 unittest.IsolatedAsyncioTestCase no longer leaks its executor (GH-91680)

2022-04-19 09:40:52 -07:00

urllib

[3.9] gh-105704: Disallow square brackets ([ and ]) in domain names for parsed URLs (GH-129418) (#129530 )

2025-02-19 14:36:40 +01:00

venv

[3.9] gh-124651: Quote template strings in venv activation scripts (GH-124712) (GH-126185) (GH-126269) (GH-126301)

2024-11-04 16:16:35 +01:00

wsgiref

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

xml

[3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116272)

2024-03-07 00:03:30 +01:00

xmlrpc

bpo-45386: Handle strftime's ValueError graciously in xmlrpc.client (GH-28765) (GH-28935)

2021-10-13 20:00:05 +02:00

zoneinfo

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

__future__.py

…

__phello__.foo.py

…

_aix_support.py

bpo-43666: Lib/_aix_support.py routines may fail in a WPAR environment (GH-25095) (#25880 )

2021-05-04 11:00:47 +02:00

_bootlocale.py

…

_bootsubprocess.py

…

_collections_abc.py

replace self param with more appropriate cls in classmethods (GH-31402) (#31445 )

2022-02-21 02:10:35 +02:00

_compat_pickle.py

…

_compression.py

…

_markupbase.py

[3.9] bpo-34480: fix bug where match variable is used prior to being defined (GH-17643) (GH-32256)

2022-05-16 18:19:04 +02:00

_osx_support.py

[3.9] Remove trailing spaces (GH-28710)

2021-10-03 20:04:38 +03:00

_py_abc.py

…

_pydecimal.py

…

_pyio.py

bpo-25415: Remove confusing sentence from IOBase docstrings (PR-31631)

2022-03-04 10:34:14 -08:00

_sitebuiltins.py

…

_strptime.py

bpo-43295: Fix error handling of datetime.strptime format string '%z' (GH-24627) (#25695 )

2021-05-19 20:37:49 -04:00

_threading_local.py

…

_weakrefset.py

bpo-44962: Fix a race in WeakKeyDict, WeakValueDict and WeakSet when two threads attempt to commit the last pending removal (GH-27921) (GH-28014)

2021-08-28 20:54:48 +02:00

abc.py

Clarify the order of a stacked abstractmethod (GH-26892)

2021-06-27 11:50:45 -07:00

aifc.py

…

antigravity.py

…

argparse.py

gh-91832: Add 'required' attr to argparse.Action repr (GH-91841)

2022-04-28 08:19:07 -07:00

ast.py

[3.9] gh-95588: Drop the safety claim from ast.literal_eval docs. (GH-95919) (GH-126729)

2024-12-03 17:08:42 +01:00

asynchat.py

…

asyncore.py

…

base64.py

bpo-39068: Fix race condition in base64 (GH-17627)

2021-01-01 12:42:44 -08:00

bdb.py

fix docstring typo in bdb.py (GH-22323) (#26180 )

2021-05-17 00:43:26 +01:00

binhex.py

[3.9] bpo-29566: binhex.binhex now consitently writes MacOS 9 line endings. (GH-23059) (GH-23071)

2020-11-01 01:39:26 -08:00

bisect.py

…

bz2.py

bpo-44439: BZ2File.write()/LZMAFile.write() handle length correctly (GH-26846)

2021-06-22 16:57:41 +03:00

calendar.py

…

cgi.py

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) (#24528 )

2021-02-15 10:03:31 -08:00

cgitb.py

…

chunk.py

…

cmd.py

…

code.py

…

codecs.py

bpo-14014: Clarify StreamWriter.reset() documentation (GH-13716)

2021-01-06 04:27:30 +02:00

codeop.py

…

colorsys.py

…

compileall.py

Fix missing space with help for -m compileall -o (GH-27591) (GH-28431)

2021-09-18 00:55:37 +02:00

configparser.py

bpo-41963: document that ConfigParser strips off comments (GH-26197) (GH-26213)

2021-05-18 18:44:48 +02:00

contextlib.py

[3.9] bpo-44594: fix (Async)ExitStack handling of __context__ (gh-27089) (GH-28731)

2021-10-04 23:37:24 -07:00

contextvars.py

…

copy.py

bpo-45752: Remove "array" from list of things that cannot be copied in copy module docstring (GH-29555)

2021-11-14 05:21:32 -08:00

copyreg.py

[3.9] bpo-41052: Fix pickling heap types implemented in C with protocols 0 and 1 (GH-22870). (GH-22963)

2020-10-25 17:56:17 +02:00

cProfile.py

[3.9] gh-103935: Use io.open_code() when executing code in trace and profile modules (GH-103947) (#103953 )

2023-05-22 12:40:30 +02:00

crypt.py

…

csv.py

…

dataclasses.py

[3.9] bpo-45662: Fix the repr of InitVar with a type alias to the built-in class (GH-29291) (GH-29924)

2021-12-10 11:42:49 +02:00

datetime.py

Check result of utc_to_seconds and skip fold probe in pure Python (GH-91582) (GH-92748)

2022-05-16 17:33:01 +02:00

decimal.py

…

difflib.py

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

dis.py

…

doctest.py

bpo-2604: Make doctest.DocTestCase reset globs in teardown (GH-31932)

2022-03-22 14:27:26 -07:00

enum.py

[Enum] improve pickle support (#26666 )

2021-06-11 01:26:32 -07:00

filecmp.py

bpo-42958: Improve description of shallow= in filecmp.cmp docs (GH-27166) (GH-27608)

2021-08-04 22:09:45 +02:00

fileinput.py

…

fnmatch.py

bpo-36769: Document that fnmatch.filter supports any kind of iterable (GH-13039)

2020-12-18 11:34:27 -08:00

formatter.py

…

fractions.py

…

ftplib.py

bpo-43285 Make ftplib not trust the PASV response. (GH-24838)

2021-03-15 12:02:45 -07:00

functools.py

[3.9] bpo-46032: Check types in singledispatch's register() at declaration time (GH-30050) (GH-30254) (GH-30255)

2021-12-26 14:23:23 +02:00

genericpath.py

…

getopt.py

…

getpass.py

update docstring for win_getpass to reflect code changes (GH-24967)

2021-05-04 00:10:32 -07:00

gettext.py

…

glob.py

[3.9] bpo-44482: Fix very unlikely resource leak in glob in non-CPython implementations (GH-26843). (GH-26916)

2021-06-27 14:28:24 +03:00

graphlib.py

[3.9] [codemod] Fix non-matching bracket pairs (GH-28473) (GH-28512)

2021-09-22 17:32:04 +02:00

gzip.py

[3.9] Fix typo in comment (GH-26162) (GH-26165)

2021-05-16 11:08:10 -07:00

hashlib.py

…

heapq.py

…

hmac.py

…

imaplib.py

[3.9] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#130248 )

2025-02-19 14:31:01 +01:00

imghdr.py

…

imp.py

…

inspect.py

bpo-43118: Fix bug in inspect.signature around 'base.__text_signature__' (GH-30285)

2022-01-21 14:06:35 -08:00

io.py

…

ipaddress.py

[3.9] gh-122792: Make IPv4-mapped IPv6 address properties consistent with IPv4 (GH-122793) (GH-123819) (GH-127571)

2024-12-03 18:42:19 +01:00

keyword.py

…

linecache.py

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

locale.py

…

lzma.py

bpo-44439: BZ2File.write()/LZMAFile.write() handle length correctly (GH-26846)

2021-06-22 16:57:41 +03:00

mailbox.py

…

mailcap.py

[3.9] gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (#98190 )

2022-10-11 23:13:18 +02:00

mimetypes.py

bpo-20392: Fix inconsistency with uppercase file extensions in mimetypes.guess_type (GH-30229)

2022-03-15 08:50:01 -07:00

modulefinder.py

…

netrc.py

…

nntplib.py

…

ntpath.py

…

nturl2path.py

bpo-43607: Fix urllib handling of Windows paths with \\?\ prefix (GH-25539)

2021-04-23 10:28:05 -07:00

numbers.py

bpo-44072: fix Complex, Integral docs for ** (GH-25986)

2021-05-14 15:25:43 -07:00

opcode.py

…

operator.py

[3.9] bpo-44558: Match countOf is/== treatment to c (GH-27007). (GH-27055)

2021-07-07 23:55:22 +09:00

optparse.py

…

os.py

…

pathlib.py

bpo-27827: identify a greater range of reserved filename on Windows. (GH-26698) (#27422 )

2021-07-28 17:15:51 +02:00

pdb.py

bpo-46434: Handle missing docstrings in pdb help (GH-30705)

2022-01-21 09:33:25 -08:00

pickle.py

[3.9] Fix typos in the Lib directory (GH-28775) (GH-28803)

2021-10-07 08:42:38 -07:00

pickletools.py

…

pipes.py

…

pkgutil.py

[3.9] [codemod] Fix non-matching bracket pairs (GH-28473) (GH-28512)

2021-09-22 17:32:04 +02:00

platform.py

bpo-44572: On Windows, disconnect STDIN in platform._syscmd_ver() to prevent erroneous STDIN consumption (GH-27092)

2021-07-14 17:17:18 +01:00

plistlib.py

bpo-42249: Fix writing binary Plist files larger than 4 GiB. (GH-23121)

2020-11-03 13:32:59 -08:00

poplib.py

…

posixpath.py

bpo-26329: update os.path.normpath documentation (GH-20138) (#27095 )

2021-07-12 17:22:33 +02:00

pprint.py

…

profile.py

[3.9] gh-103935: Use io.open_code() when executing code in trace and profile modules (GH-103947) (#103953 )

2023-05-22 12:40:30 +02:00

pstats.py

…

pty.py

…

py_compile.py

…

pyclbr.py

…

pydoc.py

[3.9] bpo-40296: Fix supporting generic aliases in pydoc (GH-30253). (GH-31976) (GH-31981)

2022-03-19 17:12:48 +02:00

queue.py

gh-90879: Fix missing parameter for put_nowait() (GH-91514)

2022-04-14 02:23:15 -07:00

quopri.py

…

random.py

bpo-44018: random.seed() no longer mutates its inputs (GH-25856) (GH-25864)

2021-05-03 16:36:14 -07:00

re.py

…

reprlib.py

…

rlcompleter.py

bpo-44752: refactor part of rlcompleter.Completer.attr_matches (GH-27433) (GH-27446)

2021-07-29 17:46:07 +02:00

runpy.py

bpo-26792: Improve docstrings of runpy module run_functions (GH-30729)

2022-04-29 11:46:47 -07:00

sched.py

…

secrets.py

…

selectors.py

…

shelve.py

…

shlex.py

…

shutil.py

[3.9] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) (#104382 )

2023-05-15 18:53:58 +02:00

signal.py

[3.10] bpo-27718: Fix help for the signal module (GH-30063) (GH-30080)

2021-12-13 02:43:13 -08:00

site.py

[3.9] gh-113659: Skip hidden .pth files (GH-113660) (GH-114146)

2024-01-17 15:28:17 +01:00

smtpd.py

…

smtplib.py

bpo-43124: Fix smtplib multiple CRLF injection (GH-25987) (GH-28035)

2021-08-29 16:45:25 +02:00

sndhdr.py

…

socket.py

[3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) (GH-122508)

2024-08-02 15:10:52 +02:00

socketserver.py

[3.9] bpo-37193: Remove thread objects which finished process its request (GH-23127) (GH-24750)

2021-03-04 08:36:41 -08:00

sre_compile.py

[3.9] gh-91575: Update case-insensitive matching in re to the latest Unicode version (GH-91580). (GH-91661) (GH-91837)

2022-04-22 22:02:56 +03:00

sre_constants.py

[3.9] gh-92049: Forbid pickling constants re._constants.SUCCESS etc (GH-92070) (GH-92073) (GH-92102)

2022-05-01 13:01:56 +03:00

sre_parse.py

[3.9] gh-91700: Validate the group number in conditional expression in RE (GH-91702) (GH-91831) (GH-91836)

2022-04-22 22:02:20 +03:00

ssl.py

[3.9] gh-108342: Break ref cycle in SSLSocket._create() exc (GH-108344) (#108351 )

2023-08-23 12:10:49 +02:00

stat.py

…

statistics.py

Fix double-space in exception message (GH-29955) (GH-29983)

2021-12-08 13:41:50 +02:00

string.py

…

stringprep.py

…

struct.py

…

subprocess.py

[3.9] gh-101283: Improved fallback logic for subprocess with shell=True on Windows (GH-101286) (#101709 )

2023-02-09 10:59:40 +01:00

sunau.py

…

symbol.py

…

symtable.py

…

sysconfig.py

bpo-42504: Ensure that get_config_var('MACOSX_DEPLOYMENT_TARGET') is a string (GH-24341) (GH-24410)

2021-01-31 23:22:48 -05:00

tabnanny.py

…

tarfile.py

[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH-121286) (#123641 )

2024-09-04 17:46:01 +02:00

telnetlib.py

…

tempfile.py

[3.9] gh-91133: tempfile.TemporaryDirectory: fix symlink bug in cleanup (GH-99930) (GH-112842)

2024-01-17 14:47:47 +01:00

textwrap.py

…

this.py

…

threading.py

gh-92530: Fix an issue that occurred after interrupting threading.Condition.notify (GH-92534) (GH-92831)

2022-05-16 17:25:31 +02:00

timeit.py

…

token.py

…

tokenize.py

bpo-44667: Treat correctly lines ending with comments and no newlines in the Python tokenizer (GH-27499) (GH-27501)

2021-08-02 11:44:01 +02:00

trace.py

[3.9] gh-103935: Use io.open_code() when executing code in trace and profile modules (GH-103947) (#103953 )

2023-05-22 12:40:30 +02:00

traceback.py

bpo-45614: Fix traceback display for exceptions with invalid module name (GH-29726) (GH-29827)

2021-11-29 10:11:48 +00:00

tracemalloc.py

bpo-37961: Fix regression in tracemalloc.Traceback.__repr__ (GH-23805)

2020-12-16 14:01:14 -08:00

tty.py

…

turtle.py

bpo-45837: Note tiltangle is not deprecated, it's really settiltangle (GH-29630)

2021-11-19 19:55:15 +01:00

types.py

bpo-45664: Fix resolve_bases() and new_class() for GenericAlias instance as a base (GH-29298) (GH-29928)

2021-12-07 14:00:06 +02:00

typing.py

Lib/typing.py copy edits originating from GH-31061 (GH-31684)

2022-03-04 19:21:51 -08:00

uu.py

[3.9] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) (#104331 )

2023-05-22 12:41:30 +02:00

uuid.py

…

warnings.py

…

wave.py

…

weakref.py

bpo-44962: Fix a race in WeakKeyDict, WeakValueDict and WeakSet when two threads attempt to commit the last pending removal (GH-27921) (GH-28014)

2021-08-28 20:54:48 +02:00

webbrowser.py

bpo-41754: Ignore NotADirectoryError in invocation of xdg-settings (GH-23075)

2020-11-08 02:07:44 -08:00

xdrlib.py

…

zipapp.py

…

zipfile.py

[3.9] gh-123270: Replaced SanitizedNames with a more surgical fix. (GH-123354) (#123432 )

2024-09-04 17:46:48 +02:00

zipimport.py

…